ai-code-review

# AI-Generated Code Security Review Security review checklist and methodology for code produced by AI coding assistants (Claude, Copilot, Cursor, Gemini, or any LLM-based tool). AI-generated code has characteristic failure modes that differ from human-written code and require specific review attention. ## When to Use - Reviewing PRs or patches marked with `Assisted-by:` or `Generated-by:` attribution - Auditing code known or suspected to be AI-generated - As a supplementary checklist during any code review where AI assistance was used - Verifying AI-generated security fixes or test code ## When NOT to Use - General code review without AI involvement (use `module/skills/differential-review/SKILL.md`) - Reviewing AI model behavior or prompt injection (use `module/skills/prompt-injection-mitigation/SKILL.md`) - Evaluating AI tool security posture (use `module/skills/third-party-model-security/SKILL.md` or `module/skills/file-protection/SKILL.md`) ## AI-Specific Failure Modes AI code generation has characteristic error patterns that differ from typical human mistakes. Review for these specifically: ### 1. Hallucinated APIs and symbols LLMs confidently generate calls to functions, methods, flags, configuration keys, or library features that do not exist. These compile or parse correctly but fail at runtime, or worse, silently do nothing. **Detection:** - Verify every imported module, function call, and configuration key against the actual codebase and libra...